Free Tools
Security Header Generators & CSP Validator
Build production-ready security headers visually — no docs needed. Copy and paste into your server config.
script-src
Custom
style-src
Custom
img-src
Custom
font-src
Custom
connect-src
Custom
Frame & Form Control
Extras
Tip: Start with the strict defaults above and gradually allow sources as needed. Avoid
'unsafe-inline' and 'unsafe-eval' — use nonces or hashes instead.
max-age — How long browsers enforce HTTPS
Options
includeSubDomains
Apply HSTS to all subdomains
preload
Submit to browser preload list
Preload Requirements
To join the HSTS preload list:
max-age must be ≥ 31536000 (1 year), includeSubDomains must be set, and preload must be present. Submit at hstspreload.org.
max-age must be ≥ 31536000 (1 year), includeSubDomains must be set, and preload must be present. Submit at hstspreload.org.
Toggle each browser feature on or off. Off = blocked () means your site and any iframes cannot use this API. Self = your origin only.
Hardware Access
Sensors & Location
Media & Display
Payment & Identity
Best practice: Block everything you don't use. If your site never needs the camera or microphone, setting them to
() means a compromised third-party script can't silently activate them.
Access-Control-Allow-Origin
Specify the allowed origin, or * for public APIs that don't use credentials.
Access-Control-Allow-Methods
Access-Control-Allow-Headers
Custom
Options
Allow-Credentials
Send cookies / auth headers cross-origin
Access-Control-Max-Age (seconds)
How long the browser caches the preflight result.
Tip: Only expose CORS headers on API endpoints that genuinely need cross-origin access. Never set
* on endpoints that handle authenticated requests — use an explicit origin allowlist instead.
Paste an existing Content-Security-Policy header value below to check for misconfigurations, dangerous directives, and missing protections.